Authorization checks in server.py

doc/how_to/authentication/user_info.md

@@ -38,3 +38,29 @@ The auth template must be a valid Jinja2 template and accepts a number of argume
 - `{{ error_type }}`: The type of error.
 - `{{ error }}`: A short description of the error.
 - `{{ error_msg }}`: A full description of the error.
+
+The `authorization_callback` may also contain a second parameter, which is set by the
+requested application path. You can use this extra parameter to check if a user is
+authenticated _and_ has access to the application at the given path.
+
+```python
+from urllib import parse
+import panel as pn
+
+authorized_user_paths = {
+    "user1": ["/app1", "/app2"],
+    "user2": ["/app1"],
+}
+
+def authorize(user_info, request_path):
+    current_user = user_info['username']
+    current_path = parse.urlparse(request_path).path
+    if current_user not in authorized_user_paths:
+        return False
+    current_user_paths = authorized_user_paths[current_user]
+    if current_path in current_user_paths:
+        return True
+    return False
+
+pn.config.authorize_callback = authorize
+```

panel/config.py

@@ -110,7 +110,11 @@ class _config(_base_config):
         is enabled. The callback is given the user information returned
         by the configured Auth provider and should return True or False
         depending on whether the user is authorized to access the
-        application.""")
+        application. The callback may also contain a second parameter,
+        which is the requested path the user is making. If the user
+        is authenticated and has explicit access to the path, then
+        the callback should return True otherwise it should return
+        False.""")
 
     auth_template = param.Path(default=None, doc="""
         A jinja2 template rendered when the authorize_callback determines

panel/io/server.py

@@ -485,26 +485,34 @@ async def get(self, *args, **kwargs):
                 token = session.token
             logger.info(LOG_SESSION_CREATED, id(session.document))
             with set_curdoc(session.document):
-                if config.authorize_callback and not config.authorize_callback(state.user_info):
-                    if config.auth_template:
-                        with open(config.auth_template) as f:
-                            template = _env.from_string(f.read())
-                    else:
-                        template = ERROR_TEMPLATE
-                    page = template.render(
-                        npm_cdn=config.npm_cdn,
-                        title='Panel: Authorization Error',
-                        error_type='Authorization Error',
-                        error='User is not authorized.',
-                        error_msg=f'{state.user} is not authorized to access this application.'
-                    )
-                else:
-                    resources = Resources.from_bokeh(self.application.resources())
-                    page = server_html_page_for_session(
-                        session, resources=resources, title=session.document.title,
-                        token=token, template=session.document.template,
-                        template_variables=session.document.template_variables,
-                    )
+                resources = Resources.from_bokeh(self.application.resources())
+                page = server_html_page_for_session(
+                    session, resources=resources, title=session.document.title,
+                    token=token, template=session.document.template,
+                    template_variables=session.document.template_variables,
+                )
+                if config.authorize_callback:
+                    import inspect
+                    authorize_callback_signature = inspect.signature(config.authorize_callback)
+                    authorize_callback_parameters = authorize_callback_signature.parameters
+                    authorized = False
+                    if len(authorize_callback_parameters) == 1:
+                        authorized = config.authorize_callback(state.user_info)
+                    if len(authorize_callback_parameters) == 2:
+                        authorized = config.authorize_callback(state.user_info, self.request.path)
+                    if not authorized:
+                        if config.auth_template:
+                            with open(config.auth_template) as f:
+                                template = _env.from_string(f.read())
+                        else:
+                            template = ERROR_TEMPLATE
+                        page = template.render(
+                            npm_cdn=config.npm_cdn,
+                            title='Panel: Authorization Error',
+                            error_type='Authorization Error',
+                            error='User is not authorized.',
+                            error_msg=f'{state.user} is not authorized to access this application.'
+                        )
         self.set_header("Content-Type", 'text/html')
         self.write(page)